Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Categories

In this Discussion

› › Problems with Spamhaus - Page 2
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Problems with Spamhaus

2

Comments

  • angstromangstrom Moderator
    edited April 2019

    The OP seems to be using his real (Edit: or at least, traceable) name. He also seems to be behind (or associated with) https://nvpn.net/ , so: @nVPN

    Edit: @nVPN started a thread once that is no longer available. Probably because he didn't have his provider tag.

  • deankdeank Member, Troll
    edited April 2019

    Can't be his real name. Only kids do that because they don't know any better.

  • legalstufflegalstuff Member 
    SBL437644 185.244.25.171 2019-03-08 Malware distribution @185.244.25.171
SBL437642 185.244.25.220 2019-03-08 Malware distribution @185.244.25.220
SBL437641 185.244.25.198 2019-03-08 Malware distribution @185.244.25.198
SBL437640 185.244.25.199 2019-03-08 Malware distribution @185.244.25.199
SBL437639 185.244.25.234 2019-03-08 Malware distribution @185.244.25.234
SBL437638 185.244.25.145 2019-03-08 Malware distribution @185.244.25.145
SBL409273 185.244.25.173 2018-08-16 Neurevt botnet controller @185.244.25.173

    This has nothing in common with VPN. You hosted a botnet web controller at 185.244.25.173, then you hosted a web-server with your malicious .exe's and distributed them from .171, .220 and so on.

    There is not a lot you can invent here to defend yourself, unless you tell 'I own a big CDN company like Cloudflare and my customers hide their site IPs behind my reverse proxies'

  • legalstufflegalstuff Member

    The port scanning part shows you port scan routers and infect them by hijacking DNS or something, so their users actively download your .exe from 'Malware distribution' nodes.

    Man, you are so obvious, learn to lie at least.

  • deankdeank Member, Troll

    If he is indeed using his real name as his username, indeed he really has to learn to lie.

  • FranciscoFrancisco Top Host, Host Rep, Veteran

    legalstuff said: This has nothing in common with VPN. You hosted a botnet web controller at 185.244.25.173, then you hosted a web-server with your malicious .exe's and distributed them from .171, .220 and so on.

    There is not a lot you can invent here to defend yourself, unless you tell 'I own a big CDN company like Cloudflare and my customers hide their site IPs behind my reverse proxies'

    Yeah, I agree on this.

    To have so many bad listings with in a single /24, you're going to grow a lot of bad press.

    I'm fairly sure the OP, or maybe someone in a similar situation, has asked for BGP sessions from us but that their users do host RATs/Malware/etc on their VPN's. They were on EDROP as well and all that crap.

    I'm not sure about now, but I know in the past Spamhaus would start listing upstream/uplink IP's of ISP's if they were providing connectivity to a eDROP ranges.

    Francisco

    Thanked by 1legalstuff
  • angstromangstrom Moderator

    @deank said:
    If he is indeed using his real name as his username, indeed he really has to learn to lie.

    I'll give him +1 point for using his real (or at least, traceable) name, but -1 point for not saying that he's associated with nVpn. My guess is: @David_Craig = @nVPN

  • legalstufflegalstuff Member

    He is not using his real name, this guy is an experienced spammer/hacker. Just needs to lie better.

  • David_CraigDavid_Craig Member
    edited April 2019

    This EDROP listing is just an example of a prefix not being removed by Spamhaus: https://www.spamhaus.org/sbl/query/SBL437655
    It is not linked a VPN, but to a hosting service.

  • deankdeank Member, Troll

    Well, his last post confirms the suspicion that he is indeed nVPN.

    Refusing/evading to answer is always an indirect confirmation.

  • legalstufflegalstuff Member

    But he is also saying he is not a VPN service anymore, but a hosting service now. Changed his mind.

  • deankdeank Member, Troll
    edited April 2019

    Does that matter? He can switch to VPN at any point.

    He's probably doing that in his defense to get his range off the list.

  • David_CraigDavid_Craig Member
    edited April 2019

    What difference does it make if someone runs a VPN or a hosting service?
    If you would run any of it you would see things from a different perspective.
    This whole discussion thread is totally counterproductive.

  • angstromangstrom Moderator

    Well, the IP address range 185.244.25.* is used by KV Solutions in the Netherlands, https://www.kvsolutions.nl/ , and they offer shared hosting and VPSes.

  • David_CraigDavid_Craig Member

    And what's so bad about that?

  • legalstufflegalstuff Member
    edited April 2019

    They also lease IPv4 ranges:

    /24(256 IPV4)
    Setup fee € 25.00
    €150.00/monthly

    Kv Solutions belongs to this member with a provider tag https://www.lowendtalk.com/profile/KVsolutions_NL

    Thanked by 1angstrom
  • deankdeank Member, Troll

    OP believes in "free and unrestricted internet access".

    That should equal to honesty which OP ain't showing.

  • angstromangstrom Moderator
    edited April 2019

    @David_Craig said: This whole discussion thread is totally counterproductive.

    Well, you must know that LET is full of skeptical people.

    Realistically, what kind of reaction do you expect from us based on the data that you've presented? Were we all supposed to form a chorus and curse at Spamhaus?

  • David_CraigDavid_Craig Member
    edited April 2019

    To be honest: If I would have known beforehand in which way this discussion leads, I wouldn't have opened this thread.

  • alexvolkalexvolk Member
    edited April 2019

    @David_Craig said:
    To be honest: If I would have known beforehand in which way this discussion leads, I wouldn't have opened this thread.

    Be honest that's what we're asking, don't blame others while trying to hide some important information :wink:

  • user54321user54321 Member

    Well atleast for me spamhaus is trash, i had a /30 swip where clearly was stated that it is used for Tor exit hosting, they did list a /22 instead of that /30 which made my provider very unhappy and insisted they will only delist it if they terminate the Tor nodes.
    Spamhaus is really a big problem because they give a fuck about everything. I can only say everybody stop using them because the collateral damage on clean IP ranges is huge.

  • deankdeank Member, Troll

    Oh, I have little doubt that Spamhaus is crap.

    In OP's case though, I love'em.

    Thanked by 1trewq
  • legalstufflegalstuff Member

    Yep spamhaus did nothing wrong blacklisting a vpn malware distribution range.

  • user54321user54321 Member

    If they would do what they say on their website they wouldn't be crap, but they list spam + stuff and people they don't like and that with huge ranges instead of the IPs with stuff and people they don't like.
    So yes they are crap, they act like the mafia and not like a nonprofit organization.

  • KuJoeKuJoe Member, Host Rep

    @David_Craig said:
    Seems to me you don't believe in free and unrestricted internet access.

    So why are you trying to censor or stop Spamhaus from taking part in this free and unrestricted internet? Spamhaus is an opt-in service, it's not hard coded into the IP protocol. Either you believe in all freedom or you believe in censorship, there is no middle ground.

    I've never had any issues with Spamhaus and they're always fast to reply to me when I do need to contact them. That being said, I'm not a fan of them. This thread is just not doing a good job at conveying the issues with them and instead is giving examples of why they're beneficial to the internet.

  • legalstufflegalstuff Member

    Looks like OP has found his old account registered in 2017

  • user54321user54321 Member

    @legalstuff said:
    Looks like OP has found his old account registered in 2017

    suck my balls to put me in the same bin with op.

  • alexvolkalexvolk Member

    I can dig more @David_Craig. So you're indeed @nVPN

    % Information related to '91.193.75.0 - 91.193.75.255'

    % Abuse contact for '91.193.75.0 - 91.193.75.255' is '[email protected]'
    inetnum: 91.193.75.0 - 91.193.75.255
    netname: Freedom_Of_Speech_VPN
    remarks: SPAMHAUS, please note:
    remarks: This subnet belongs to our non-logging VPN service.
    remarks: It is our aim to protect the private sphere of journalists,
    remarks: lawyers, human rights activists and whistleblowers.
    remarks: We allow port forwarding on our servers.
    remarks: Please refrain from DROP listing 91.193.75.0/24!
    remarks: Thank you.
    country: SC

    https://www.spamhaus.org/sbl/query/SBL442782

    SBL441490 2019-04-03 NanoCore botnet controller @91.193.75.13
SBL441274 2019-04-03 RemcosRAT botnet controller @91.193.75.23
SBL435991 2019-03-14 RemcosRAT botnet controller @91.193.75.23

    % Information related to '91.192.100.1 - 91.192.100.63'

    % Abuse contact for '91.192.100.1 - 91.192.100.63' is '[email protected]'
    inetnum: 91.192.100.1 - 91.192.100.63
    netname: Gerber_non-logging_VPN_service
    country: CH
    admin-c: JG8768-RIPE
    tech-c: JG8768-RIPE
    org: ORG-GE100-RIPE
    abuse-c: GE2550-RIPE
    status: ASSIGNED PA
    mnt-by: MNT-DA327
    created: 2017-11-14T13:09:30Z
    last-modified: 2017-11-15T08:57:40Z
    source: RIPE

    https://www.spamhaus.org/sbl/query/SBL442790

    SBL442586 2019-04-05 Spam source @91.192.100.48
SBL442574 2019-04-05 Adwind botnet controller @91.192.100.14
SBL442294 2019-04-03 Adwind botnet controller @91.192.100.48
SBL442018 2019-04-01 RemcosRAT botnet controller @91.192.100.57
SBL441949 2019-03-31 NanoCore botnet controller @91.192.100.20
SBL441284 2019-03-27 NanoCore botnet controller @91.192.100.11
SBL441160 2019-03-27 Adwind botnet controller @91.192.100.48
SBL440338 2019-03-27 NanoCore botnet controller @91.192.100.14
SBL439791 2019-03-27 RemcosRAT botnet controller @91.192.100.5
SBL439450 2019-03-21 RemcosRAT botnet controller @91.192.100.4
SBL439433 2019-03-27 RemcosRAT botnet controller @91.192.100.9
SBL439420 2019-03-21 Adwind botnet controller @91.192.100.47
SBL439070 2019-03-15 Adwind botnet controller @91.192.100.6
SBL439068 2019-03-17 Adwind botnet controller @91.192.100.6
SBL438913 2019-03-17 NanoCore botnet controller @91.192.100.7
SBL437772 2019-03-10 RemcosRAT botnet controller @91.192.100.37
SBL437613 2019-03-17 RemcosRAT botnet controller @91.192.100.9
SBL437455 2019-03-10 NanoCore botnet controller @91.192.100.54
SBL437443 2019-03-09 NanoCore botnet controller @91.192.100.7
SBL435578 2019-03-07 RemcosRAT botnet controller @91.192.100.9
SBL435212 2019-03-07 NanoCore botnet controller @91.192.100.40
SBL434638 2019-02-28 RemcosRAT botnet controller @91.192.100.3
SBL434343 2019-03-07 RemcosRAT botnet controller @91.192.100.57
SBL434230 2019-02-28 RemcosRAT botnet controller @91.192.100.61
SBL434229 2019-02-28 NanoCore botnet controller @91.192.100.40
SBL433676 2019-02-28 RemcosRAT botnet controller @91.192.100.37
SBL433665 2019-02-28 NanoCore botnet controller @91.192.100.4
SBL433174 2019-02-28 RemcosRAT botnet controller @91.192.100.34
SBL432515 2019-02-09 Adwind botnet controller @91.192.100.44
SBL432426 2019-02-09 Adwind botnet controller @91.192.100.52
and many more...

    % Information related to '89.35.228.192 - 89.35.228.255'

    % Abuse contact for '89.35.228.192 - 89.35.228.255' is '[email protected]'

    inetnum: 89.35.228.192 - 89.35.228.255
    netname: AnMaXX
    descr: AnMaXX
    country: RO
    admin-c: AM38880-RIPE
    tech-c: AM38880-RIPE
    status: SUB-ALLOCATED PA
    org: ORG-AI151-RIPE
    mnt-by: Smart
    mnt-by: TeenTelecom
    created: 2017-02-13T09:01:09Z
    last-modified: 2017-02-13T10:52:38Z
    source: RIPE

    https://www.spamhaus.org/sbl/query/SBL442787

    SBL434368 2019-02-28 NanoCore botnet controller @89.35.228.222
SBL431947 2019-01-31 NanoCore botnet controller @89.35.228.216
SBL430964 2019-01-26 NanoCore botnet controller @89.35.228.216
SBL428888 2019-01-16 RemcosRAT botnet controller @89.35.228.211
SBL428676 2019-01-16 AgentTesla botnet controller @89.35.228.199
SBL423261 2018-11-05 DarkComet botnet controller @89.35.228.201
SBL422271 2018-10-31 NanoCore botnet controller @89.35.228.196
SBL420315 2018-10-10 NanoCore botnet controller @89.35.228.230
SBL419475 2018-09-27 NanoCore botnet controller @89.35.228.204
SBL418174 2018-09-10 NanoCore botnet controller @89.35.228.244
SBL407996 2018-06-18 NanoCore botnet controller @89.35.228.199
SBL402541 2018-05-06 RemcosRAT botnet controller @89.35.228.194
SBL396799 2018-04-04 NanoCore botnet controller @89.35.228.192
SBL396501 2018-03-28 ImminentRAT botnet controller @89.35.228.197
SBL393509 2018-03-10 JBifrost botnet controller @89.35.228.199
SBL393325 2018-03-10 JBifrost botnet controller @89.35.228.213
SBL393224 2018-03-04 JBifrost botnet controller @89.35.228.199
SBL392505 2018-03-01 JBifrost botnet controller @89.35.228.195
SBL392161 2018-03-01 JBifrost botnet controller @89.35.228.216
SBL392072 2018-03-02 JBifrost botnet controller @89.35.228.196
SBL392035 2018-03-02 JBifrost botnet controller @89.35.228.199
SBL389739 2018-03-02 JBifrost botnet controller @89.35.228.238
SBL389097 2018-01-31 JBifrost botnet controller @89.35.228.199
SBL388131 2018-01-15 JBifrost botnet controller @89.35.228.221
SBL382456 2017-12-02 JBifrost botnet controller @89.35.228.225
SBL382157 2017-11-27 Spam source @89.35.228.193
SBL373676 2017-09-30 JBifrost botnet controller @89.35.228.242
SBL373428 2017-09-30 JBifrost botnet controller @89.35.228.195
SBL373156 2017-09-27 Adwind botnet controller @89.35.228.243
SBL366746 2017-08-23 Adwind botnet controller @89.35.228.200
SBL354395 2017-07-11 njrat botnet controller @89.35.228.231
SBL351478 2017-06-17 Adwind botnet controller @89.35.228.205

    and etc. Too much copy-pasting.

  • alexvolkalexvolk Member

    Holy crap, ColoCrossing is also involved

    AS60355 KV Solutions B.V. -> @DataWagon -> ColoCrossing :smile:

  • legalstufflegalstuff Member

    @user54321 said:

    @legalstuff said:
    Looks like OP has found his old account registered in 2017

    suck my balls to put me in the same bin with op.

    Ok David, please use your main account

Sign In or Register to comment.